General
-
Target
smss.exe
-
Size
47KB
-
MD5
73ef7a1f952dc519d57d09359ab8d527
-
SHA1
c2e72d35420ac17e637f5cec05cb2fe3b8b3c9be
-
SHA256
b9d269f2b05a9a972d83ec004aef9116da9776a2d2323eb4de05c283ead489ec
-
SHA512
0cb788ddd68a4a0413994264ed9c69a8b8c90c35377fcc5bbdd43df86db33ef5139f708a93362a194fd148b34e5e20374b417b9f3acdfd7e0ff947c411223f7c
-
SSDEEP
768:ouPfZTg4pYiWUU9jjmo2qrvxF7Handx/pcvPIX6BthC7x/af0bl21TO605ATxSWE:ouPfZTgKa2sbqdAoX6BthIZblkkANSWE
Malware Config
Extracted
asyncrat
0.5.8
Default
4.tcp.eu.ngrok.io:11252
eVSWBbTWgj8n
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
Files
-
smss.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ